SecureAnyCloud
Deployment guide

Redash

Videos

Overview: Redash on Ubuntu 24.04 LTS on Azure: overview (watch on YouTube)

Launch and log in: Redash on Ubuntu 24.04 LTS on Azure: launch and log in (watch on YouTube)

Deep Dive: Redash on Ubuntu 24.04 LTS on Azure: deep dive (watch on YouTube)

Overview

Redash is an open-source platform for querying your data with SQL, visualizing the results and assembling them into shareable dashboards. It connects to dozens of databases and APIs, runs and schedules queries, and turns result sets into charts. A team can build and share dashboards from a browser.

This SecureAnyCloud image deploys Redash 10.1.0.b50633 as the official production Docker Compose stack, fronted by an nginx reverse proxy on port 80. All state lives on a dedicated Azure data disk, every secret is rotated, and a unique admin account is created on the first boot of every VM.

What you get:

  • Redash 10.1.0.b50633 deployed from the official Docker Compose stack, pinned to redash/redash:10.1.0.b50633
  • The full multi-container stack: server (gunicorn), scheduler, two Celery workers (scheduled_worker and adhoc_worker), PostgreSQL and Redis
  • nginx on :80 as a reverse proxy to the loopback Redash server, plus a static, unauthenticated /health probe
  • PostgreSQL and Redis bound to the private Docker network only, never published on the host
  • A per-VM admin account (email, password and API key) generated on first boot and recorded in a root-only file
  • A dedicated Azure data disk at /var/lib/redash that holds the PostgreSQL metadata database and Redis data, with the Docker data-root relocated there
  • redash.service, redash-firstboot.service, nginx.service and docker.service as enabled, active systemd units
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B4ms (4 vCPU / 16 GiB RAM) is the recommended size, because the multi-container Redash stack needs the memory.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp. Redash serves plain HTTP on port 80, so for production, terminate TLS in front of it with your own domain.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Redash by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size (Standard_B4ms or larger). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:redash-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name redash \
  --image sac1647283583153:redash-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name redash --port 80 --priority 1010

First boot takes a few minutes. In the background, the VM generates its own credentials and starts the services. If you connect as soon as the VM shows as running, wait for that setup to finish before you continue:

bash sudo cloud-init status --wait

The command prints status: done when the VM is ready. The credentials and services described below exist only after that point.

Step 3 - Connect to your VM

Connect to the VM over SSH:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Redash runs as a Docker Compose stack managed by redash.service, behind nginx. Confirm the units are active:

systemctl is-active redash.service nginx.service docker.service

Each unit reports active. On first boot, the image rotates every secret and creates a per-VM admin account.

Step 5 - Confirm the container stack

The stack runs six containers: the web server, the scheduler, two Celery workers, PostgreSQL and Redis. List them:

docker compose -f /opt/redash/docker-compose.yml ps

All six report Up. PostgreSQL and Redis are attached to the private Docker network only and are never published on the host. Only nginx on port 80 is reachable from outside.

Step 6 - Confirm the health and ping endpoints

nginx serves a static, unauthenticated /health file for load balancers and probes. It also proxies Redash's own /ping liveness endpoint. Check the health endpoint first:

curl -s -o /dev/null -w 'health=%{http_code}\n' http://localhost/health

The command returns health=200. Then check Redash's application ping, which returns PONG:

curl -s http://localhost/ping; echo

Step 7 - Retrieve your admin credentials

Your VM generates its own admin email, password and API key on first boot and writes them to a root-only file. Read it as root:

cat /root/redash-credentials.txt

The file contains REDASH_ADMIN_EMAIL (admin@sac.local), REDASH_ADMIN_PASSWORD and REDASH_ADMIN_API_KEY. Store them somewhere safe.

Step 8 - Sign in to the Redash web UI

Browse to http://<vm-public-ip>/ and sign in as admin@sac.local with the password from Step 7.

After you sign in, you land on the Dashboards home. The left navigation lists Dashboards, Queries, Alerts and Create.

Open Create > New Query to reach the query editor. Write SQL against a connected data source, run it, and turn the result into a visualization.

Open Settings > Data Sources to connect Redash to your databases and APIs, including PostgreSQL, MySQL, BigQuery, Redshift, Elasticsearch and many more.

Step 9 - Verify the REST API with your API key

Every Redash user has an API key that authenticates REST calls without a session. Read the per-VM admin key from the credentials file and call the dashboards endpoint:

API=$(grep '^REDASH_ADMIN_API_KEY=' /root/redash-credentials.txt | cut -d= -f2-)
curl -s -o /dev/null -w 'api=%{http_code}\n' -H "Authorization: Key $API" http://localhost/api/dashboards

The command returns api=200. A request with a wrong key is rejected.

To authenticate as a browser session instead, POST your admin email and password to the login form. For example, curl -i -c cookies.txt -d 'email=admin@sac.local' -d 'password=<REDASH_ADMIN_PASSWORD>' http://<vm-public-ip>/login returns a 302 redirect on success.

Step 10 - Confirm data lives on the dedicated disk

The PostgreSQL metadata database (users, queries, dashboards and cached results) and the Redis data live on the dedicated Azure data disk. The data survives OS changes, and you can resize the disk independently. Confirm the mount:

findmnt /var/lib/redash

The mount is backed by a separate Azure data disk that is captured into the image and re-provisioned on every VM. Docker's data-root is relocated under it, so every Redash named volume lands on the resizable disk.

Inviting your team by email (SMTP setup)

The image does not include an outbound email server, because sending mail needs credentials for your own provider: SendGrid, Microsoft 365, Google Workspace, Amazon SES or your own SMTP server. Until you add them, Redash cannot send user invitations or alert emails. Configure them once and both start working.

  • Edit the Redash environment file and add your provider's settings. The file already contains a REDASH_MAIL_DEFAULT_SENDER line, so change it to a real address on your domain:

bash sudo nano /opt/redash/.env

REDASH_MAIL_SERVER=smtp.sendgrid.net REDASH_MAIL_PORT=587 REDASH_MAIL_USE_TLS=true REDASH_MAIL_USERNAME=apikey REDASH_MAIL_PASSWORD=<your-smtp-password-or-api-key> REDASH_MAIL_DEFAULT_SENDER=redash@yourdomain.com

For Microsoft 365, use smtp.office365.com on port 587 with TLS. For SendGrid, the username is the literal word apikey and the password is your API key. If your provider uses SSL on port 465, set REDASH_MAIL_USE_SSL=true instead of the TLS line.

Make sure no line has a trailing space after its value. Docker reads trailing spaces literally, and the login will fail.

  • Recreate the stack so every container, including the background workers that send the mail, picks up the new settings. A plain restart does not always reload them:

bash cd /opt/redash && sudo docker compose up -d --force-recreate

  • Confirm that it works. Invite a user from Settings > Users, or send a test message that prints the exact SMTP response. Replace the recipient with an inbox you can check:

bash cd /opt/redash && sudo docker compose run --rm --entrypoint python server -c " import os, smtplib s = smtplib.SMTP(os.environ['REDASH_MAIL_SERVER'].strip(), int(os.environ['REDASH_MAIL_PORT'])) s.set_debuglevel(1); s.starttls() s.login(os.environ['REDASH_MAIL_USERNAME'].strip(), os.environ['REDASH_MAIL_PASSWORD'].strip()) s.sendmail(os.environ['REDASH_MAIL_DEFAULT_SENDER'].strip(), ['you@yourdomain.com'], 'Subject: Redash SMTP test\n\nWorks!') s.quit(); print('OK') "

Reaching external inboxes (Gmail, Outlook). Verifying a single sender is enough to send mail. However, Gmail and Outlook often junk or reject mail from a domain that is not authenticated at your provider.

If test mail reaches your own mailbox but invitations to external addresses do not, set up domain authentication. In SendGrid, go to Settings > Sender Authentication > Authenticate Your Domain. Then add the SPF and DKIM records it gives you to your DNS. Most providers show a per-message delivery log (SendGrid's is the Activity Feed) that tells you whether each invitation was delivered, dropped or blocked, and why.

Invite links. The sign-in link in the invitation is built from REDASH_HOST in the same .env file. It is set to your VM's address on first boot. If you move Redash behind a custom domain or HTTPS, update REDASH_HOST to match so the links resolve.

If the test email works but invitations never arrive. In this case, invitations also never appear in your provider's send logs. Redash sends the test email directly from the server container, but it sends invitation and alert emails through a background worker on its emails queue. Confirm that a worker is assigned that queue.

Open /opt/redash/docker-compose.yml, find the adhoc_worker service, and make sure its QUEUES line includes emails:

adhoc_worker: ... environment: QUEUES: 'queries,emails,default,periodic'

If emails is missing, add it as above, then recreate the stack so the worker picks it up:

cd /opt/redash && sudo docker compose up -d --force-recreate

Resend the invitation. It is now sent and appears in your provider's activity log. Any invitations you queued before the change may all send at once when the worker starts.

Building with Redash

Connect a data source under Settings > Data Sources, write a query in the editor and save it. Add a visualization to the query, such as a chart, counter, pivot or table. Then pin one or more visualizations onto a dashboard and share it with your team.

You can schedule queries to refresh on an interval, which the scheduler and workers handle. Alerts notify you when a value crosses a threshold. The Redash documentation covers the query language, data source options and API reference.

Maintenance

  • Admin users. Add users and groups from Settings > Users and Settings > Groups in the web UI.
  • Backups. Snapshot the /var/lib/redash data disk, or back up the PostgreSQL metadata database inside the postgres container.
  • Data. The metadata database and Redis data live under /var/lib/redash (the Docker data-root).
  • Stack control. Manage the stack with sudo systemctl restart redash.service, or with docker compose in /opt/redash.
  • TLS. Redash serves plain HTTP on port 80. In production, front it with TLS (for example certbot) and your own domain.
  • Upgrades. Edit the pinned image tag in /opt/redash/docker-compose.yml, then run sudo systemctl restart redash.service.
  • Security patches. unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. For questions or help with your deployment, contact sales@secureanycloud.com.

Deploy on Azure

Launch Redash on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure